Data Brokers: The Industry That Knows Everything About You and Answers to No One

You've never signed a contract with them. You've probably never heard their name. But somewhere in a data broker's warehouse sits a file that knows your income bracket, your medications, the church you attended last Sunday, the fact that you searched for divorce lawyers at 2 a.m., and roughly how likely you are to default on a loan — all of it stitched together from scraps you handed over to completely different companies, none of which mentioned where it would eventually end up.

An Industry Built on Data You Never Handed Over

A data broker is a company whose entire business is collecting personal information about people it has no direct relationship with, then selling access to that information to whoever will pay — marketers, insurers, background-check services, political campaigns, and increasingly, government agencies. There are thousands of these companies operating in the US alone, and almost none of them are household names, because their customers are other businesses, not you. You are not the client. You are the inventory.

Where the Data Actually Comes From

No single source hands over a complete profile. It's built by cross-referencing dozens of them: public records like property deeds, voter rolls, and court filings; loyalty card purchase histories sold by retailers; location pings sold by free apps whose privacy policy buried the permission six screens deep; browsing and purchase data from ad-tech partnerships most sites never surface to a user at all; and, most efficiently, data bought from other brokers who already did the aggregating. A profile that looks impossibly detailed usually isn't the product of one company watching you closely — it's dozens of companies each watching a sliver of you, and one broker buying all the slivers.

No single company needs to know everything about you. It just needs to know one thing, and know who to sell it to.

Who's Buying Your Profile

Advertisers are the obvious customer, using broker data to target ads more precisely than a platform's own data allows. But the buyer list runs further: insurers use purchase and lifestyle data to help estimate risk before a policy is priced. Employers and landlords run background packages built partly on broker data during screening. Debt collectors and skip tracers buy location and associate data to find people. And law enforcement and federal agencies have purchased access to broker datasets — including location histories — as a way to obtain information a court might otherwise require a warrant to compel directly from a phone carrier.

Why Opting Out Barely Works

Most brokers technically offer an opt-out. In practice, there is no single form: privacy researchers have counted several hundred distinct data broker companies operating in the US, each with its own separate opt-out process, its own verification hurdles, and its own timeline before the request is even honored. Delete your record from one broker and a data refresh a few months later can simply repopulate it from the same public and commercial sources that built it the first time. Opting out one broker at a time is less like closing an account and more like bailing out a boat with a cup while new water keeps coming in through a hole nobody will point to.

What's Actually in a Data Broker Profile

• Financial inference scores — estimated income, creditworthiness signals, and spending capacity, built from purchase and public-record patterns rather than any bank ever disclosing an account
• Health-adjacent categories — not diagnoses directly, but purchases and searches specific enough to imply them, like mobility aids, particular medications, or fertility-related products
• Precise location histories — patterns of everywhere a device has been, sold in bulk and re-identifiable down to a specific home or workplace address
• Life-event flags — recent moves, marriages, divorces, or new children, each one a signal brokers package and sell specifically because people spend differently during them

The Regulatory Patchwork

A small number of US states have passed laws requiring data brokers to register publicly, and at least one now requires a single, centralized deletion mechanism that lets a resident request removal from every registered broker in the state at once, rather than hundreds of separate forms. Other states have floated similar rules without passing them. There is still no comprehensive federal data broker law, no single opt-out that covers the whole country, and no requirement that a broker tell you what it has collected unless you happen to live somewhere that asks. Until that changes, the industry's default setting remains collect first, and make deletion someone else's job.

What You Can Actually Do

• Check whether your state has a centralized broker-deletion law before manually opting out of individual companies one by one
• Search your own name on people-search sites periodically — a listing reappearing is a sign a previous opt-out has lapsed, not a one-time task completed
• Review location and contact permissions on free apps specifically — that's the entry point for a large share of the data brokers resell
• Treat a loyalty card or rewards app as a data-sharing agreement, not a free discount, because for many programs that's the actual transaction underneath it

None of this requires a hacker or a breach. It's an entire legitimate industry, operating in the open, built on the simple fact that scattering your data across a hundred small transactions feels private, while quietly making it easy for one company to buy the pieces back and reassemble the whole picture — no permission required, because nobody ever asked in a way you'd have noticed.